Gameguard and Comodo

[Guest]

[EricJH]

It is just a wild thought. Could it be that Windows Live Messenger is being seen as a risk by Gameguard?

[kawaii]

I don't think so. When i have D+ completly disabled everything works fine, and WLM and gameguard run toghether without any problems.

[EricJH]

Could you check the logs of the Firewall and D+ for events with WLM and Gameguard?

[kawaii]

Ok, this time i have put D+ to "disabled" (rather than completly disabled) and unchecked all the monitor settings.
Again the problem remains the same. As soon as cabal/gameguard is active, the processes loose their "user name" and again WLM is not able to login. The firewall logs shows nothing (Windows Live messenger is defined as a trusted application)
When i have D+ completly disabled (the box with "need to reboot" checked) and i start cabal, the task manager is completly normal.

I've attached a screenshot of the process manager, together with the D+ settings i used. And i should add that in the first beta release of 3.8 not only WLM didn't work, but no program would start when D+ was running.

_{PS: I appreciate the help :-)}

[EricJH]

Thx for the information. I see msnmsgr.exe is not in your Task Manager list. Please start WLM with gameguard running. Then look up the logs of the Firewall and D+.

The logs can be found under Firewall --> Common Tasks --> View Firewall Events and D+  --> Common Tasks --> View Defense+ Events. Show me what is being logged in both logs with a screenshot.

If I understand correctly WLM will start up but won't connect, right?

[kawaii]

Both logs show nothing at all (all WLM processes are listed as "trusted applications")

When i'm already signed on WLM, and than start cabal/gameguard everything works fine too. When i close WLM and try to sign-in again it fails if gameguard is running. I even tested it on another PC (again windows XP SP3, but this time no NOD32, just CIS with AV, and the problem is identical)

[EricJH]

For now I am out of inspiration. I am willing to call it a bug. May be someone else knows a different angle to look at the problem?

[kawaii]

Well i can't think of much else to do, so i keep D+ disabled for now.
Thanks for the help anyway

[kawaii]

Bump.

The latest beta/RC’s of 3.9 branch don’t include fixes (yet) for this problem. I’m hoping some dev will take a closer look into this problem, since I’d like to use D+

Short problem overview:
Gameguard (rev 1294) injects/hacks into kernel.dll in order to hide the processes from Cabal Online (so cheat programs can’t hack into the game processes)
With CIS/D+ running ALL process names disappear, and the cabal processes disappear from the task manager (this last is intended/normal behavior). With D+ completely disabled everything works fine, and cabal processes are hidden while the other processes remain intact.
Even with the entire Cabal/gameguard directories white listed problems remain.
Completely disabling all D+ settings (unchecking all boxes, security level at disabled, but not the permanent deactivate function) still results in the problem (processes without names, and unable to sign-in to WLM)

A complete fix would of course be the best, but I would be very happy if I could white list the entire Cabal (or gameguard) folders, but keep the D+ functionality for all other programs/actions.

[kawaii]

EDIT:
OK did a clean install from CIS 3.9 (with proactive defense settings in setup) and everything fails again, and it's back like i described in the startpost.

[tolcarn]

This kind of throws the cat amongst the pigeons to me:

XP pro sp3 desktop system (rather old)
Comodo 3.9.95478.509 (self updated)
Rappelz game
nProtect GameMon rev 1247

works fine (and never had any problems between the two on it)
EDIT: defense+ is set to safe mode.

Vista home basic on laptop (brand new compaq)
Same Comodo (clean install)
Same Rappelz game
nProtect GameMon rev 1247 (even to the extent of copying over game guard files from desktop)

Game guard says:
Game Guard initialization error.<BR>Try again after a reboot or close programs that are currently running.

No fix with D+ disabled
Can only get it to work (+ using shared internet connection of desktop) if I uninstall Comodo:(

[razor74]

Unfortunately comodo has destroyed game playability on all online games that run Gameguard protection and programers responsible and capable to resolve this problem has nothing to says. NO OTHER security program has problems with latest build of Gameguard, but COMODO... Iti is a security incompatibility between Comodo and GAMEGUARD. It is very clear. No doubt.

[kawaii]

OK did a clean install from CIS 3.9 (with proactive defense settings in setup) and everything fails again, and it's back like i described in the startpost. Gameguard has reached revision 1335, but that hasn't made any difference either.

So i'm back to running cis without defense+ again.

[kawaii]

This kind of throws the cat amongst the pigeons to me:

XP pro sp3 desktop system (rather old)
Comodo 3.9.95478.509 (self updated)
Rappelz game
nProtect GameMon rev 1247

works fine (and never had any problems between the two on it)
EDIT: defense+ is set to safe mode.

Vista home basic on laptop (brand new compaq)
Same Comodo (clean install)
Same Rappelz game
nProtect GameMon rev 1247 (even to the extent of copying over game guard files from desktop)

Game guard says:
Game Guard initialization error.<BR>Try again after a reboot or close programs that are currently running.

No fix with D+ disabled
Can only get it to work (+ using shared internet connection of desktop) if I uninstall Comodo:(

This might partially be a problem of Vista too, since Vista/W7 blocks some of the functions of gameguard. Later verions of gameguard should fix this (currently Cabal uses 1340)

[kawaii]

3.10 EPIC FAIL UPDATE

All previous versions it was ok to disable D+ completly, but on 3.10 that solution doesn't work anymore. And the problems are bigger.
I have only the firewall turned on (security level was Proactive Defense Update)
Now NOT A SINGLE PROGRAM will start while gameguard (rev 1352) is running. Going back to 3.9 to untill i finally get some more feedback.


Only positive thing about 3.10 was that threatcast notification worked for the first time.

[Tags:]